CVE-2019-17498 - CVE House
Back to Database
Status published High CVE-2019-17498

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in...

Vulnerability Description

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-17498

Credits & Attribution

No credits recorded in the NVD database.

References

More from libssh2

View All →
CVE-2025-15661
libssh2 - Heap Buffer Over-read via sftp_symlink() in sftp.c
High 8.3
CVE-2020-22218
An issue was discovered in function _libssh2_packet_add in libssh2 1.10.0...
High 7.5
CVE-2019-13115
In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer...
High 8.1

Affected Vendor

Affected Software

libssh2, fedora, leap, debian linux, active iq unified manager, element software, hci management node, ontap select deploy administration utility, solidfire, bootstrap os
Vulnerable Versions:
0, 30, 31, 15.1, 8.0, 9.0

Timeline

Official Publish: October 21st, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.